Privacy Notice
Last updated: 17 August 2026
Who we are
Sprout & Spark operates this website and learning platform and is the data controller for the personal data described here. Accounts are held by grown-ups (parents, guardians or teachers) on behalf of the children who play.
What we collect and why
- Account data (email, display name, login credentials managed by our authentication provider) — to create and secure your account. Legal basis: performance of our contract with you.
- Learning data (challenges completed, predictions, journal entries, badges, progress) — to show progress and keep the experience personal. Legal basis: contract.
- Usage and device data (pages viewed, actions taken, approximate device and browser information, IP address) — for security, fraud prevention and improving the product. Legal basis: legitimate interests.
- Support and feedback messages — to answer you. Legal basis: legitimate interests.
- Marketing emails, only if you ask for them. Legal basis: consent, which you can withdraw at any time.
We do not show ads, we do not sell personal data, and children cannot chat with strangers on the platform.
Who we share data with
- Service providers who host the site, database, authentication and analytics for us.
- Paddle.com, our Merchant of Record, for the sale of the Standard plan, payments, invoicing and tax compliance.
- Professional advisers (legal, accounting) where necessary.
- Authorities where we are required to by law.
Some providers are located outside the UK/EEA. Where data is transferred internationally we rely on adequacy decisions or Standard Contractual Clauses.
How long we keep it
Account and learning data are kept while your account is active and for up to 12 months after you stop using the service, then deleted or anonymised. Records we must keep for tax or legal reasons are kept for the required period.
Your rights
You can request access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests, and withdraw consent at any time. We respond within one month. If you are in the UK/EEA you can also complain to your local data protection authority. Contact us through the feedback button on any page.
Security
We use appropriate technical and organisational measures, including encryption in transit, access controls and row-level database security, to protect personal data.
Cookies and local storage
We use essential cookies and browser storage to keep you signed in, remember your language and store progress on this device, plus privacy-friendly usage analytics to understand which challenges work well. You can clear or block these in your browser settings; essential ones are needed for the site to work.
See also our Terms & Conditions and Refund Policy.